fix(auth): atomically secure Windows lock creation

tools/tht/internal/authconfig/store_windows_test.go

@@ -4,8 +4,10 @@ package authconfig
 
 import (
 	"errors"
+	"fmt"
 	"path/filepath"
 	"runtime"
+	"sync"
 	"testing"
 
 	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
@@ -49,9 +51,52 @@ func TestMutateUsersCreatesAndRejectsPermissiveWindowsLockDACL(t *testing.T) {
 	}
 }
 
-func writePrivateWindowsAuthFiles(t *testing.T) string {
+func TestMutateUsersConcurrentWindowsLockCreationNeverObservesDefaultDACL(t *testing.T) {
+	users := adminUserYAML("admin", "Admin", true, "admin")
+	for index := 0; index < 32; index++ {
+		users += userYAML(index)
+	}
+	directory := writePrivateWindowsAuthFiles(t, registryYAML(users))
+
+	var group sync.WaitGroup
+	var ready sync.WaitGroup
+	start := make(chan struct{})
+	errors := make(chan error, 32)
+	for index := 0; index < 32; index++ {
+		index := index
+		group.Add(1)
+		ready.Add(1)
+		go func() {
+			defer group.Done()
+			ready.Done()
+			<-start
+			errors <- MutateUsers(directory, func(registry *Registry) error {
+				registry.Users[index+1].DisplayName = fmt.Sprintf("Windows Updated %d", index)
+				return nil
+			})
+		}()
+	}
+	ready.Wait()
+	close(start)
+	group.Wait()
+	close(errors)
+	for err := range errors {
+		if err != nil {
+			t.Fatalf("MutateUsers() concurrent lock creation error = %v", err)
+		}
+	}
+	if err := safeio.ValidatePrivateRegular(filepath.Join(directory, lockFileName)); err != nil {
+		t.Fatalf("concurrently created lock DACL error = %v", err)
+	}
+}
+
+func writePrivateWindowsAuthFiles(t *testing.T, users ...string) string {
 	t.Helper()
-	directory := writeAuthFiles(t, defaultAuthYAML, registryYAML(adminUserYAML("admin", "Admin", true, "admin")))
+	registry := registryYAML(adminUserYAML("admin", "Admin", true, "admin"))
+	if len(users) > 0 {
+		registry = users[0]
+	}
+	directory := writeAuthFiles(t, defaultAuthYAML, registry)
 	if err := safeio.ProtectPrivateDirectory(directory); err != nil {
 		t.Fatal(err)
 	}